CVE-2026-33330

Katalog CVE

CVSS 7.1 · High EPSS 0,38%

Kerentanan Incorrect Authorization pada filerise. Skor CVSS 3.1 7.1 (High) menurut github.com.

Deskripsi (NVD)

FileRise is a self-hosted web file manager / WebDAV server. Prior to version 3.10.0, a broken access control issue in FileRise's ONLYOFFICE integration allows an authenticated user with read-only access to obtain a signed save callbackUrl for a file and then directly forge the ONLYOFFICE save callback to overwrite that file with attacker-controlled content. This issue has been patched in version 3.10.0.

Rincian

Terbit di NVD

24 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 30,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/error311/FileRise/security/advisories/GHSA-6c3j-f4x4-36m3 exploit · mitigasi · advisory vendor
• https://github.com/error311/FileRise/commit/3871f9fd1661688bed4f7dd23912be0ebf50973c patch
• https://github.com/error311/FileRise/releases/tag/v3.10.0 product · release notes